WO2017032347A1 - 基于客户机的主动防基站诱骗方法和系统 - Google Patents

基于客户机的主动防基站诱骗方法和系统 Download PDF

Info

Publication number
WO2017032347A1
WO2017032347A1 PCT/CN2016/101527 CN2016101527W WO2017032347A1 WO 2017032347 A1 WO2017032347 A1 WO 2017032347A1 CN 2016101527 W CN2016101527 W CN 2016101527W WO 2017032347 A1 WO2017032347 A1 WO 2017032347A1
Authority
WO
WIPO (PCT)
Prior art keywords
base station
client
information
authentication information
target base
Prior art date
Application number
PCT/CN2016/101527
Other languages
English (en)
French (fr)
Inventor
吴旭莲
臧玉生
刘红光
Original Assignee
盾宇（上海）信息科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 盾宇（上海）信息科技有限公司 filed Critical 盾宇（上海）信息科技有限公司
Publication of WO2017032347A1 publication Critical patent/WO2017032347A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud

Definitions

  • the present invention relates to wireless network security, and in particular to a client-based active anti-base station deception method and system.
  • Wi-Fi is a wireless network connection method widely used in smart devices. It is widely deployed and used in the fields of personal, enterprise, and intelligent terminal automation.
  • Wireless information security refers not only to the connection security and communication security of the Wi-Fi host, but also to the client Wi-Fi connection security and communication security.
  • the wireless security field mainly refers to protecting the target ESSID base station password from being cracked, preventing illegal clients from connecting to the host and preventing the network.
  • the main methods adopted are to make the base station encryption more and more complicated, and the method of periodically issuing the authentication private key greatly reduces the risk of the password being decrypted; for the Wi-Fi client, there are a large number of phishing base stations, and the client is connected by implementing active deception. Get authentication information.
  • the base station spoofs the user to connect to the base station, captures the corresponding base station password, and even tracks the client network communication to intercept the information. There is currently no effective way to protect the secure connection of clients.
  • the present invention is designed to solve the problem of clients being tricked.
  • the security of certification information is mainly through the following methods:
  • Querying the AP database is generally directed to free Wi-Fi in public areas. For Wi-Fi that is not recorded in the database, it is not recognized.
  • the invention provides a method for clearing a rogue AP in a wireless local area.
  • the wireless AP monitors the existence of the rogue AP in real time, cuts off the communication connection between the rogue AP and the wireless user, and notifies the wireless user of the existence of the rogue AP in time. Remind users to update the wireless AP's wireless password and wireless encryption method in a timely manner.
  • the protection starting point of the invention is to use a wireless AP to monitor an illegal AP, to cut off the connection between the illegal AP and the user, thereby achieving protection of secure communication, and the disadvantage is that it is impossible to ensure the elimination of the illegal AP; and the present invention is performed by the client from the perspective of the client. Active defense, eliminating the high accuracy of illegal APs.
  • the recognition result of the invention for the pseudo base station is notified to the client by the real base station, but from the perspective of the client, it is difficult to confirm whether the base station that issued the notification is a true base station, that is, the pseudo base station cannot be excluded from issuing a notification to mislead the client.
  • the true base station mistakes the possibility of a pseudo base station.
  • the invention discloses a wireless security authentication method for a mobile terminal.
  • Existing mobile terminals have lower computing power and security.
  • the invention uses Diffie-Hellman security key exchange algorithm, digital certificate technology, DES symmetric encryption algorithm, and combines certificate local verification technology, secondary login technology and time stamp technology.
  • the mobile terminal registers; secondly, performs local authentication of the user identity certificate and the mobile terminal logs in to the authentication server, thereby implementing the function of the mobile terminal registering and logging in to the authentication server in the wireless network.
  • the key authentication used in the invention if a trusted terminal is used as a rogue AP, the other devices may be induced to be indirectly connected, and communication of other terminals cannot be guaranteed.
  • the invention is directed to wireless security authentication of a mobile terminal.
  • the protection point is to prevent an illegal terminal from logging into the authentication server, and the mobile terminal cannot be protected from being deceived, and the purpose of the present invention is to prevent the client from being tricked by an illegal server.
  • the invention provides a method, a client, a server and a system for identifying a fake Wi-Fi, and belongs to the field of wireless network security.
  • the method includes: the client scans the service set identifier SSID of the Wi-Fi, and obtains the MAC address corresponding to the service set identifier SSID; and queries whether the MAC address exists in the MAC address library, when the query result indicates When the MAC address exists and is located in the MAC black library of the MAC address library, the service set identifier SSID corresponding to the MAC address is falsely identified.
  • This patent document identifies a pseudo base station using a MAC black library that records fake Wi-Fi, but the patent document does not teach how to deceive a pseudo base station that has not yet implemented a risk behavior into a black library, so these tricks The pseudo base station will be outside the black library for a long time. In the present invention, even if the pseudo base station does not implement the risk behavior, it can be identified before the data connection.
  • the embodiment of the invention discloses a method for identifying a wireless AP, comprising: acquiring an SSID service set identifier and a MAC physical address of a target wireless network associated with a target wireless AP connected to the terminal; prompting the user to disconnect the target wireless AP Power source, so that the terminal detects that there is no target wireless network having the MAC and the SSID; if it detects that there is no target wireless network with the MAC and the SSID in the first preset time, prompting the user Turning on power of the target wireless AP, so that the terminal can detect the target wireless network having the MAC and the SSID; if the MAC and the SSID are detected in the second preset time
  • the target wireless network recognizes that the terminal has setting authority.
  • the invention recognizes the fake Wi-Fi based on the Wi-Fi identifier SSID+MAC address, and the Wi-Fi of the pseudo base station can completely replicate the SSID+MAC address of the true Wi-Fi, thus failing to completely protect the mobile phone communication. the goal of.
  • the identification of the wireless AP by the invention depends on the user manually switching the AP power supply, that is, ensuring that the AP performs corresponding operations within the corresponding time period, thereby ensuring a secure connection.
  • the invention discloses a method and a device for monitoring a pseudo wireless access point AP, wherein the method includes: each legal AP deployed by the operator monitors the pseudo AP in the following manner: multiple legal APs managed by the operator adopt a cellular type
  • the networking solution is deployed.
  • Each legal AP works on the specified channel, and scans the beacon frame sent by the nearby AP while performing data transmission.
  • the scanned AP information is extracted from the obtained beacon frame.
  • the AP information is compared with the legal AP information database.
  • the legal AP information database stores the information of the legal AP. When the extracted AP information is not in the legal AP information database, it is determined that the scanned AP is a pseudo AP.
  • the patent document needs to rely on the legal AP database provided by the operator as the basis for matching. It belongs to the base station authentication and does not belong to the client side. Even if a legitimate AP recognizes a pseudo AP, for the client, one cannot know the information of the pseudo AP, and even if the legal AP can notify the client to discover it. A pseudo AP, but the client cannot determine whether the AP that sent the notification is a legal AP or a pseudo AP.
  • the present invention does not rely on the legal AP database provided by the operator as a basis for matching from the perspective of the client.
  • the pseudo AP in the patent document refers to an illegal, unregistered AP, and the AP spoofing information caused by the resetting of the legal AP is not taken into consideration, so the present invention can effectively target the spoofing pseudo Base station.
  • the legal AP can scan the beacon frame sent by the nearby AP
  • the pseudo base station can also scan the beacon frame sent by the nearby AP, and the pseudo base station can disguise its beacon frame as the beacon frame sent by the nearby AP. If the signal transmission power is greater than the legal AP, the deception can still be achieved; but such a decoy mode does not work for the present invention.
  • the patent document gives a technical revelation that is completely contrary to the present invention.
  • the patent document specification [0004] describes that "the current governance for pseudo-AP mainly includes... adding a pseudo AP to the mobile terminal. Monitoring function... It is necessary to install a corresponding application software on the user's mobile phone, and every time a user goes to a new wireless local area network, the data update must be performed again, and it is difficult to achieve seamless monitoring of the pseudo AP.
  • the patent document requires a database of legitimate information of the operator in each client.
  • the client is not connected to the AP, the local database cannot be updated, so there is a misjudgment behavior for some APs.
  • a client-based active anti-base station deception method includes the following heuristic steps:
  • the client sends one or more sets of authentication information to the target base station, wherein at least one set of the authentication information is masquerading information;
  • the client performs authenticity identification on the target base station according to the feedback information of the target base station to the authentication information, where the feedback information is used to indicate whether the target base station accepts the authentication information.
  • the plurality of sets of authentication information includes at least one set of real information, and the first set of authentication information sent by the client to the target base station in each identification process is masquerading information.
  • the number of sets of authentication information sent by the client to the target base station in each identification process is not completely the same.
  • the serial number (referring to the transmission sequence number) of the real information sent by the client in each identification process is not completely the same.
  • the client only sends the real information during the partial number of identification processes.
  • the masquerading information is generated based on historical base station information and/or current environmental parameters corresponding to the client.
  • the recognition result of the target base station is considered to be true; otherwise, the recognition result of the target base station is considered to be false.
  • the heuristic step is performed before the client establishes data communication with the target base station or in data communication.
  • any of the following steps is performed during a recognition process:
  • Step I The client determines the correctness of the feedback information of the target base station for the previous group of authentication information. If the result of the determination is correct, the client continues to send a set of authentication information to the target base station; Ending the probe until the feedback information of the authentication information for the real information of the target base station is rejected, the feedback information of the target base station for the authentication information for the masquerading information is accepted, or the number of repeated executions of the step I reaches the set value; or
  • Step II The client ends the heuristics after authenticating the target base station based on the feedback information of the plurality of sets of authentication information of the set number of groups by the target base station.
  • a client-based active anti-base station deception system includes a heuristic device for testing a target base station, the heuristic device comprising:
  • a first sending device sending one or more groups of authentication information to the target base station, wherein at least one group of the authentication information is masquerading information;
  • the first identifying means is configured to perform authenticity identification on the target base station according to the feedback information of the target base station to the authentication information, wherein the feedback information is used to indicate whether the target base station accepts the authentication information.
  • the plurality of sets of authentication information includes at least one set of real information, and the first set of authentication information sent by the first sending device to the target base station in each identification process is masquerading information.
  • the number of groups of authentication information sent by the first transmitting device to the target base station in each identification process is not completely the same.
  • sequence numbers of the first transmitting device transmitting the real information in each identification process are not completely the same.
  • the first transmitting device transmits the real information only during a partial number of transmissions.
  • the masquerading information is generated based on historical base station information and/or current environmental parameters corresponding to the client.
  • the first identification device performs authenticity identification on the target base station:
  • the recognition result of the target base station is considered to be true; otherwise, the recognition result of the target base station is considered to be false.
  • the heuristic to the target base station is performed before the client establishes data communication with the target base station or in data communication.
  • the first identification device comprises any one of the following:
  • step I in a single identification process, step I is repeatedly performed until the feedback information of the target base station for the authentication information for the real information is rejected, and the feedback information of the target base station for the authentication information for the masquerading information is accepted, Or, when the number of repeated executions of the step I reaches the set value, the trial is ended; wherein the step I is: the client determines the correctness of the feedback information of the target base station for the previous group of authentication information, and if the judgment result is correct The client continues to send a set of authentication information to the target base station;
  • step II in a single identification process, performing step II; wherein the step II is: the client performs authenticity identification on the target base station according to the feedback information of the plurality of sets of authentication information of the set number of groups by the target base station After that, end the temptation.
  • the present invention has the following beneficial effects:
  • the present invention provides a wireless security scheme based on client self-protection.
  • the client interacts with the base station one or more times to actively identify the authenticity of the base station.
  • the client actively sends the authentication information before the client and the base station actually establish a connection, and the client actively recognizes the pseudo base station according to the feature that the pseudo base station completely accepts the client authentication information, and ensures that the client actively recognizes the pseudo base station to ensure Communication security.
  • FIG. 1 is a schematic structural diagram of a client-based active anti-base station deception system provided by the present invention
  • FIG. 2 is a schematic flowchart diagram of a client-based active anti-base station deception method provided by the present invention
  • Figure 3 is a schematic diagram of a set of authentication information for real information
  • FIG. 4 is a schematic diagram of camouflage information of the authentication information in FIG. 3;
  • FIG. 5 is a schematic diagram of the principle of multiple interactions between a client and a base station
  • Figure 6 is a schematic diagram of the application of the present invention.
  • Figure 7 is a schematic diagram of the working cooperation between the sub-devices of the probe device of the present invention, wherein “the first transmitting device - the second identifying device” represents a working cooperation schematic diagram between the first transmitting device and the second identifying device, The "first transmitting device - third identifying device” indicates a working cooperation schematic diagram between the first transmitting device and the third identifying device.
  • a client-based active anti-base station deception system includes a heuristic device for testing a target base station, the heuristic device comprising:
  • a first sending device sending one or more groups of authentication information to the target base station, wherein at least one group of the authentication information is masquerading information;
  • the first identifying means is configured to perform authenticity identification on the target base station according to the feedback information of the target base station to the authentication information, wherein the feedback information is used to indicate whether the target base station accepts the authentication information.
  • the plurality of sets of authentication information includes at least one set of real information, and the first set of authentication information sent by the first sending device to the target base station in each identification process is masquerading information.
  • the number of groups of authentication information sent by the first transmitting device to the target base station in each identification process is not completely the same.
  • sequence numbers of the first transmitting device transmitting the real information in each identification process are not completely the same.
  • the first transmitting device transmits the real information only during a partial number of transmissions.
  • the masquerading information is generated based on historical base station information and/or current environmental parameters corresponding to the client.
  • the first identification device performs authenticity identification on the target base station:
  • the recognition result of the target base station is considered to be true; otherwise, the recognition result of the target base station is considered to be false.
  • the heuristic to the target base station is before the client establishes data communication with the target base station or data communication Executed in.
  • the first identification device comprises any one of the following:
  • step I is repeatedly performed until the feedback information of the target base station for the authentication information for the real information is rejected (ie, the correctness of the feedback information of the target base station for the authentication information for the real information) It is erroneous) that the feedback information of the target base station for the authentication information for masquerading information is accepted (ie, the correctness of the feedback information of the target base station for the authentication information for the masquerading information is erroneous), or the number of repeated executions of step I is reached.
  • step I the client determines the correctness of the feedback information of the target base station for the previous group of authentication information, and if the judgment result is correct, the client continues to the target base station. Send a set of authentication information;
  • step II in a single identification process, performing step II; wherein the step II is: the client performs authenticity identification on the target base station according to the feedback information of the plurality of sets of authentication information of the set number of groups by the target base station After that, end the temptation.
  • the client-based active anti-base station deception system can be implemented by a process step of a client-based active anti-base station deception method.
  • client-based active anti-base station deception method can be implemented by a process step of a client-based active anti-base station deception method.
  • client-based active anti-base station deception method is specifically as follows.
  • a client-based active anti-base station deception method includes the following heuristic steps:
  • the client sends one or more sets of authentication information to the target base station, wherein at least one set of the authentication information is masquerading information;
  • the client performs authenticity identification on the target base station according to the feedback information of the target base station to the authentication information, where the feedback information is used to indicate whether the target base station accepts the authentication information. That is, the client verifies whether the processing of the authentication information by the target base station is in accordance with the feedback information. For example, the client's expectation of the transmitted real information is fed back to the target base station for authentication, and the client's expectation of the sent spoofing information is The target base station feedback failed the authentication.
  • the client can establish a connection with a target base station (for example, a Wi-Fi base station) in a wireless manner (for example, a short-range wireless communication method such as Wi-Fi) to join the wireless local area network where the target base station is located, and then connect to the Internet through the target base station.
  • a target base station for example, a Wi-Fi base station
  • the client can be a smartphone; the client can also be an IoT terminal, such as an object box of a household appliance.
  • the target base station is a wireless base station.
  • the purpose of the heuristic step is to prevent the pseudo base station from deceiving the security information such as the password, and to detect whether the pseudo base station is deceived by the correctness of the feedback information of the authentication information by the base station, so that the client is not easily pseudo.
  • the successful deception of the base station leads to the initiative to send real information.
  • the heuristic step is further for the client to perform reverse spoofing to the base station as the target base station through the probe step, so that the pseudo base station mistakenly believes The authentication information for the real information has been obtained, thereby stopping the continued deception of the real information.
  • a client can reverse spoofing a pseudo base station.
  • the back-trick pseudo base station misjudges the masquerading information as real information.
  • the back-trick pseudo base station misjudges the real information as masquerading information.
  • the back-trick pseudo base station mistakenly believes that the plurality of sets of authentication information sent by the client contain (or do not contain) real information.
  • the reverse decoy pseudo base station mistakenly believes that the plurality of sets of authentication information sent by the client in each authenticity identification is regular (or irregular).
  • the back-trick pseudo base station misjudges that the client's heuristics have started (or not started) and that the heuristics have ended (or not ended).
  • the above reverse deception method can be used singly or in multiple ways, especially in a different combination of each identification or heuristic to achieve the effect of confusing the pseudo base station.
  • Each group of authentication information may be composed of a plurality of pieces of information, wherein at least one of the plurality of pieces of information is private information (such as a password, etc.), that is, information that the pseudo base station needs to deceive.
  • each set of authentication information can consist primarily of a username and password.
  • the masquerading information refers to authentication information used to masquerade as real information for the target base station. If the feedback information of a base station for the masquerading information is or is mostly accepted (ie, the authentication is passed), the base station can be regarded as a pseudo base station.
  • the real information can also be mixed in the masquerading information in the authentication information sent by the client to the target base station.
  • the pseudo base station can be designed to reject (ie, not accept) the feedback information of all the authentication information to pass the heuristic, and therefore, it is necessary to disguise the information.
  • the pseudo base station does not know whether to accept or accept one or a few authentication information and does not know which one or which authentication information is to be rejected, so that the pseudo base station cannot Feedback on all authentication information is rejected by means of temptation.
  • the sent authentication information may be camouflage information, so that the pseudo base station is vainly searching for the real information that does not exist in the camouflage information.
  • the number of sets of authentication information sent by the client in the heuristic can be used to confuse the pseudo base station so that the pseudo base station does not know when the probe starts and ends. Assuming that the client always sends the authentication information of the fixed number of groups, the pseudo base station can grasp the regularity and obtain the authentication information of the next group of the true information.
  • the order of execution between the steps of the feedback information of the target base station and the authenticity of the target base station may be performed in multiple ways. For example, first, the client sends multiple sets of authentication information to the target base station. Correspondingly, the client also receives multiple feedback information of the target base station, and then the client performs authenticity identification on the target base station. For example, the client sends a set of authentication information to the target base station, and then feedbacks according to the group of authentication information. The information is used for real-time (or real-time) base station authenticity identification. If the recognition result is a true base station, the next group of authentication information is continuously transmitted. If the recognition result is a pseudo base station, the heuristic can be ended.
  • the step of the client sending one or more sets of authentication information to the target base station may be initiated by the client to perform heuristics on the surrounding base stations, and form a white list including the true base station and a blacklist including the pseudo base station, and
  • the base station may be probed by the client before the data connection needs to be established, or the base station of the current data connection may be probed during the data connection process.
  • the step of performing authenticity identification on the target base station may perform authenticity identification based on feedback information corresponding to a group of authentication information or feedback information corresponding to multiple sets of authentication information, for example, preferably the feedback information is correctly 100%.
  • the base station is identified as a true base station.
  • the feedback information is used to indicate whether the target base station accepts the authentication information.
  • the client is ready to establish a data connection with a base station (the base station is assumed to be a pseudo base station), so the base station is probed to ensure information security.
  • the client sends a set of authentication information R1 to the base station.
  • the group of authentication information R1 is masquerading information. If the base station's feedback information for the group of authentication information R1 is accepted, that is, through authentication, the client bases the base station. It is identified as a pseudo base station.
  • the client is ready to establish a data connection with a base station (the base station is assumed to be a pseudo base station), so the base station is probed to ensure information security.
  • the client sends two sets of authentication information R1 and R2 to the base station.
  • the group of authentication information R1 and R2 are all masquerading information. If the feedback information of the group authentication information R1 is rejected, the authentication fails. If the feedback information of the authentication information group R2 is accepted, the client can identify the base station as a pseudo base station according to the fact that the correctness rate of the feedback information of the base station is too low.
  • the plurality of sets of authentication information includes at least one set of real information
  • the first set of authentication information sent by the client to the target base station in each identification process is masquerading information.
  • the purpose of the first group of authentication information sent to the target base station is that the spoofing information is: if the first group of authentication information sent to the target base station is real information, if the base station is a true base station, the feedback information of the true base station is After receiving the authentication, if the base station is a pseudo base station, the feedback information of the pseudo base station is also accepted for authentication, and the feedback information of the real base station and the feedback information of the pseudo base station are indistinguishable. Therefore, the first group of authentication information is To disguise information.
  • the client is ready to establish a data connection with a base station (the base station is assumed to be a pseudo base station), so the base station is probed to ensure information security.
  • the client sends two sets of authentication information R1 to the base station.
  • R2 the authentication information group R1 is masquerading information
  • the authentication information group R2 is real information. Therefore, if the pseudo base station accepts the authentication information and the rejection policy is all accepted or all rejected, the correct rate of the feedback information of the pseudo base station for the authentication information groups R1, R2 may not reach 100%, but only 50%. Thereby the client can recognize that the base station is a pseudo base station.
  • the pseudo base station may be able to obtain real information from the authentication information of multiple trials.
  • the client sends four sets of authentication information R101, R102, R103, R104 to the pseudo base station, where R102 is real information and the rest is masquerading information;
  • the client sends three sets of authentication information R201, R202, R203, wherein R203 is real information, and the rest is masquerading information; since the real information is unchanged, that is, R102 and R203 are the same, the pseudo base station can pass the set ⁇
  • the intersection of R101, R102, R103, R104 ⁇ and the set ⁇ R201, R202, R203 ⁇ gives real information.
  • the client can send the same group or groups of authentication information for the masquerading information in multiple trials.
  • R101 be the same as R201, so that R103 and R202 are the same, so that the set ⁇ R101, R102
  • there are a large number of groups there will be a lot of elements of the intersection, which makes it difficult for the pseudo base station to find out the real information.
  • the client sends the real information only in the process of identifying the partial number of times, wherein the heuristics are in one-to-one correspondence with the identification, that is, when the client performs a heuristic, the identification is performed correspondingly.
  • the client may also send the same group or groups of authentication information that is masquerading information in multiple trials, and does not send the real information as authentication information in at least one trial.
  • the client sends four sets of authentication information R101, R102, R103, R104 to the pseudo base station, where R102 is real information and the rest is masquerading information; in the second heuristic, the client The pseudo base station transmits three sets of authentication information R201, R202, and R203 which are all masquerading information, and R103 is the same as R203, and R101 and R202 are the same, then the set ⁇ R101, R102, R103, R104 ⁇ and the set ⁇ R201, R202, R203 There is no real information in the intersection of ⁇ R103, R201 ⁇ , and the reverse decoy pseudo base station is reached, so that the pseudo base station mistakenly believes that there is false information in the intersection.
  • the number of sets of authentication information sent by the client to the target base station in each identification process is not completely the same.
  • the pseudo base station can grasp the number of authentication information groups sent by the client to the target base station during each identification (ie, heuristic), and when the trial result is a true base station, when the client sends the authentication information again, it should be sent to the true base station as true.
  • the authentication information of the information is thus authenticated by the real base station. If the pseudo base station can confirm that the trial of the client has ended, it can be obtained and determined that the authentication information transmitted by the client next time is composed of real information. Therefore, for the client, the pseudo base station cannot be made aware of when the probe starts and when the probe ends. Therefore, the client recognizes each time
  • the number of sets of authentication information transmitted to the target base station in the process is not completely the same, so that the pseudo base station cannot know from the number of groups transmitted by the authentication information when the trial starts and when the probe ends.
  • the time interval for the client to send the adjacent group authentication information may be all the same, partially the same, or all different, so that the pseudo base station cannot also send the authentication information from the time.
  • the client sequentially transmits eight sets of authentication information at time interval t1, and transmits a ninth group of authentication information composed of masquerading information at time interval t2 (t2>t1) to reversely deceive the pseudo base station to mistakenly transmit at the client.
  • the heuristic has ended, and the ninth group of authentication information is misjudged by the real information.
  • the client sequentially sends eight sets of authentication information at the time interval t1 in the first trial, and sends two sets of authentication information at the time interval t1 in the second trial after the time interval t1 of the eighth group of authentication information transmission time. And sending the third group of authentication information at time interval t2, in order to deceive the pseudo base station to mistakenly believe that the trial has not ended after the client sends the eighth group of authentication information, and mistakenly believes that the trial has sent a total of ten sets of tentative information. And that the third group of authentication information in the second trial is the beginning of a new trial, and the third group of authentication information in the second trial can be set to be composed of real information.
  • the serial number (referring to the transmission sequence number) of the real information sent by the client in each identification process is not completely the same.
  • the real information can be sent through the second group of authentication information during the first trial, and the real information can be sent through the fifth group of authentication information in the second trial.
  • the masquerading information is generated according to historical base station information and/or current environment parameters corresponding to the client.
  • One of the ways in which the pseudo base station confirms the authentication information of the real information is to first identify the authentication information that is the masquerading information, and the remaining authentication information can be determined to be the real information. Therefore, it is necessary for the client to prevent the pseudo base station from grasping the method of generating the authentication information as the masquerading information.
  • the client may be based on the SSID (Service Set Identifier) of the base station in the historical base station information, the client password corresponding to the SSID, the last client connection location, and other objective factors in which the client is located (eg, the client's booting)
  • the current environmental parameters such as time and current temperature are generated by a mathematical algorithm such as displacement and encryption to generate an authentication information form in which a plurality of sets of authentication information are recorded.
  • the authentication information form stores N sets of authentication information, and each group of authentication information has an authenticity field attribute: the authenticity field attribute of the authentication information for the real information is true, and the authenticity field attribute of the authentication information of the disguised information is false.
  • N is a positive integer greater than one.
  • the heuristic step is performed before the client establishes data communication with the target base station.
  • the client Before establishing data communication, the client needs to test whether the base station is a true base station. If it is a pseudo base station, data communication cannot be established, that is, before the client connects with the base station, actively interact with the base station to achieve a secure connection.
  • the heuristic step is performed in data communication between the client and the target base station.
  • the client establishes data communication with the real base station, if the signal transmission power of the pseudo base station is greater than the true base station, the pseudo base station may cause interference and shielding to the real base station, so that the client is forcibly connected to the pseudo base station, so even if the client is The current time is a data connection established with the real base station, but in the data communication connection, it cannot be excluded that the next moment is forcibly connected to the pseudo base station, so whether the client continues the data connection at the next moment needs to connect to the current communication data.
  • the base station performs authenticity identification, that is, the base station at the next moment is a connection object to be identified that confirms whether to maintain the data connection or re-data connection after the client is authenticated.
  • the heuristic step can be performed in data communication between the client and the target base station to identify whether the base station currently connected to the client is a true base station, and to interrupt the data communication connection when the base station currently connected to the client is a pseudo base station . That is to say, during the communication between the client and the base station, the heuristic step can be performed intermittently to protect the client and ensure a real-time secure connection.
  • step 1 or step II is performed in one identification process.
  • Step I The client determines the correctness of the feedback information of the target base station for the previous group of authentication information. If the result of the determination is correct, the client continues to send a set of authentication information to the target base station; The test is terminated until the feedback information of the target base station for the authentication information for the real information is rejected, the feedback information of the target base station for the authentication information for the masquerading information is accepted, or the number of repeated executions of the step I reaches the set value. The client recognizes the authenticity of the base station in real time.
  • the client has sent three sets of authentication information R1, R2, and R3 that are all masquerading information, and the feedback information of the three sets of authentication information by the base station is rejected, that is, the base station for the three sets of authentication information.
  • the feedback information is correct.
  • the client sends a fourth group of authentication information R4 that is masquerading information, and the feedback information of the fourth group of authentication information R4 is accepted by the base station, that is, the feedback information of the base station for the fourth group of authentication information is Wrong, so the client identifies the base station as a pseudo base station and ends the heuristic.
  • the client continues to send a set of authentication information to the target base station for authenticity identification, and the base station is identified until the feedback information of the real information sent by the client to the target base station is correct.
  • the test is terminated.
  • the client has sent four sets of authentication information R1, R2, R3, and R4 that are all masquerading information, and the base station rejects the feedback information of the four sets of authentication information, that is, the base station performs the four sets of authentication.
  • the feedback information of the information is correct.
  • the client sends the fifth group of authentication information R5 that is real information, and the feedback information of the base station to the fifth group of authentication information R5 is accepted, that is, the base station feedbacks the fifth group of authentication information.
  • the information is correct, so the client ends the heuristic after identifying the base station as a true base station.
  • the client has issued four sets of authentication information R1, R2, R3, which are all camouflage information.
  • R4 the feedback information of the four groups of authentication information by the base station is rejected, that is, the feedback information of the base station for the four sets of authentication information is correct, and then the client detects that the number of authentication information sent in the trial has been
  • the client no longer issues the fifth group of authentication information, but identifies the base station as a true base station and ends the heuristic.
  • the client ends the heuristics after authenticating the target base station based on the feedback information of the plurality of sets of authentication information of the set number of groups by the target base station. Specifically, the step is repeated n times: the client sends a set of authentication information to the base station, and then receives feedback information of the group of authentication information by the base station; and obtains n feedback information. The client then identifies the authenticity of the base station based on the n feedback information. If the correct rate of the target base station accepting the authentication information is greater than the threshold, the recognition result of the target base station is considered to be true; otherwise, the recognition result of the target base station is considered to be false. Among them, the threshold is preferably 100%.
  • n is a positive integer
  • the value thereof can be set in advance.
  • the value of n can be set to 20.
  • the value of n in each recognition process is a value in a range of values, for example, the value range of n is set to 10 to 20, and the value of n in each recognition process is 10 to A random number in 20, wherein a person skilled in the art can implement a random number generation algorithm with reference to the prior art, and details are not described herein again.
  • the client determines whether there is a hotspot base station that is connectable and historically connected to the data; if yes, proceeds to the following steps to continue execution; if not, the available hotspot base station can be manually triggered to connect;
  • a heuristic step of performing an authenticity identification of the target base station by performing the steps "the client sends one or more sets of authentication information to the target base station” and the step “the client bases the feedback information of the authentication information according to the target base station", Obtaining the authenticity recognition result of the base station; if the recognition result is true, performing data connection with the real base station, and if the recognition result is false, the user determines whether it is necessary to manually trigger the connection;
  • the present invention also provides a computer readable storage medium storing a computer program, wherein the computer program in the computer readable storage medium causes a computer to execute the client-based active anti-base station deception method, the computer readable
  • the storage medium includes an optical disk, a magnetic disk, a ROM, a PROM, a VCD, a DVD, etc.; the client-based main The anti-base station deception method includes the following heuristic steps:
  • the client sends one or more sets of authentication information to the target base station, wherein at least one set of the authentication information is masquerading information;
  • the client performs authenticity identification on the target base station according to the feedback information of the target base station to the authentication information, where the feedback information is used to indicate whether the target base station accepts the authentication information.
  • the plurality of sets of authentication information includes at least one set of real information, and the first set of authentication information sent by the client to the target base station in each identification process is masquerading information.
  • the number of sets of authentication information sent by the client to the target base station in each identification process is not completely the same.
  • serial numbers of the real information sent by the client in each identification process are not completely the same.
  • the client only sends the real information during the partial number of identification processes.
  • the masquerading information is generated based on historical base station information and/or current environmental parameters corresponding to the client.
  • the recognition result of the target base station is considered to be true; otherwise, the recognition result of the target base station is considered to be false.
  • the heuristic step is performed before the client establishes data communication with the target base station or in data communication.
  • any of the following steps is performed during a recognition process:
  • Step I The client determines the correctness of the feedback information of the target base station for the previous group of authentication information. If the result of the determination is correct, the client continues to send a set of authentication information to the target base station; Ending the probe until the feedback information of the authentication information for the real information of the target base station is rejected, the feedback information of the target base station for the authentication information for the masquerading information is accepted, or the number of repeated executions of the step I reaches the set value; or
  • Step II The client ends the heuristics after authenticating the target base station based on the feedback information of the plurality of sets of authentication information of the set number of groups by the target base station.
  • the system provided by the present invention and its various devices can be logically gated, except that the system provided by the present invention and its various devices are implemented in purely computer readable program code. Switches, ASICs, programmable logic controllers, and embedded microcontrollers are used to achieve the same functionality. Therefore, the system and its various devices provided by the present invention can be considered as a hardware department.
  • a device for implementing various functions included therein may also be regarded as a structure within a hardware component; a device for implementing various functions may also be regarded as a software module that can be both an implementation method and The structure within the hardware components.

Abstract

本发明提供了一种基于客户机的主动防基站诱骗方法，包括试探步骤：客户机向目标基站发送一组或多组认证信息，其中，至少有一组认证信息为伪装信息；客户机根据目标基站对所述认证信息的反馈信息，对所述目标基站进行真伪识别，其中，反馈信息用于指示目标基站是否接受认证信息。本发明还提供相应的系统。本发明在伪基站诱骗客户机的情况下，客户机主动发送认证信息，根据伪基站对客户机认证信息完全接受的特点，客户机主动识别伪基站，保证通信安全。

Description

基于客户机的主动防基站诱骗方法和系统 技术领域
本发明涉及无线网络安全，具体地，涉及基于客户机的主动防基站诱骗方法和系统。
背景技术
随着互联网与物联网的发展，智能终端、传感器、安防设备接入网络的需求量越来越大。人们在家里、办公区域、公共区域使用Wi-Fi访问互联网的需求越来越普遍；传感器、MCU(单片机)、嵌入式终端利用Wi-Fi将收集到的信息发送到云端的案例将会变得越来越广泛。
Wi-Fi是智能设备广泛采用的无线网络连接方法，在个人、企业、智能终端自动化等领域，有着广泛的部署和使用。
因为Wi-Fi广泛的应用，无线信息安全变得越发重要，尤其是客户机隐私数据的安全，受到越来越重要的保护。无线信息安全，不仅仅指Wi-Fi主机的连接安全、通信安全，还包括客户机Wi-Fi连接安全，通信安全。
客户机在进行Wi-Fi连接时，完全依赖于ESSID+密码的匹配方式完成验证。针对Wi-Fi主机，无线安全领域主要是指保护目标ESSID基站密码不被破解，阻止非法客户机连接主机，防蹭网。采取的主要方法有使基站加密越来越复杂，定期发布认证私钥等方法大大降低密码被破译的风险；针对Wi-Fi客户端，存在大量的钓鱼基站，通过实施主动诱骗使客户端连接，获取认证信息。该类基站通过伪装成用户曾连接基站，套取对应基站密码，甚至跟踪客户机网络通讯，截取信息。保护客户机的安全连接，目前缺乏行之有效的方法。本发明正是为解决客户机被诱骗而设计。
目前保证认证信息安全主要是通过以下几种方法：
(a)查询可信任AP数据库。目前市场上大多数做法是收集用户免费Wi-Fi热点信息，并添加到可信任的数据库中供他人分享。
(b)手动切换Wi-Fi模式和数据模式。当输入比较私密的数据时，例如银行卡信息、密码时，切换到数据模式，这样即使连接到虚假Wi-Fi时，不会泄露关键数 据，降低风险。
(c)在公共区域连接Wi-Fi热点，咨询公共区域负责人，识别虚假Wi-Fi。
(d)利用DNS映射关系和ARP映射。目前大多数Wi-Fi监测软件就是利用DNS映射关系，识别DNS劫持；利用ARP攻击原理(改变IP对应的MAC)，查询ARP映射，识别ARP攻击。
以上几种方法有以下不足的地方：
(a)查询AP数据库一般针对公共区域免费Wi-Fi。对于在数据库中没有记录的Wi-Fi，无法识别。
(b)切换Wi-Fi模式和数据模式，影响用户上网体验，并且此类做法是降低风险，没有消除在Wi-Fi模式下带来的隐患。
(c)咨询相关负责人，一般只能识别不同名的Wi-Fi。即SSID名字不同的情况下，可以识别负责人负责的Wi-Fi，对于同名SSID且同名的虚假基站信号比真基站信号强大的情况下，虚假基站信号会覆盖掉真基站信号，此时客户机不能识别。
经对现有技术进行检索，发现如下相关文献。
相关检索结果1：
名称：一种无线局域网中清除非法AP的方法
专利申请号：CN201310262156.2
申请公布号：CN103327484A
该发明提供了一种无线局域中清除非法AP的方法，该方法中，无线AP通过实时监测非法AP的存在情况，切断非法AP与无线用户的通信连接，并及时通知无线用户非法AP的存在，提醒用户及时的更新无线AP的无线密码与无线加密方式。
技术要点比较：
1、该发明的保护出发点是利用无线AP监测非法AP，切断非法AP与用户连接，从而达到保护安全通信，缺点是无法确保排除非法AP；而本发明是从客户机角度出发，由客户机进行主动防御，排除非法AP准确率高。
2、该发明对于伪基站的识别结果由真基站通知给客户机，但是，从客户机的角度看，首先难以确认发出该通知的基站是否为真基站，即不能排除伪基站发出通知误导客户机将真基站误认为伪基站的可能性。
相关检索结果2：
名称：面向移动终端的无线安全身份验证方法
专利申请号：CN201210172805.5
申请公布号：CN102685749A
该发明公开一种面向移动终端的无线安全身份验证方法。现有移动终端计算能力和安全性都较低。本发明使用了Diffie-Hellman安全密钥交换算法、数字证书技术、DES对称加密算法，并结合证书本地验证技术、二次登录技术、时间戳技术。首先，移动终端注册；其次，进行用户身份证书本地验证和移动终端向认证服务器登录，实现移动终端在无线网络中向认证服务器注册与登录的功能。
技术要点比较：
1、该发明使用的密匙认证，如果使用一台已经授信的终端作为非法AP，可引诱其他设备间接联网，无法保证其他终端的通信安全。
2、该发明是针对移动终端的无线安全身份验证，保护点在于防止非法终端登录认证服务器，无法保护移动终端不受诱骗，而本发明的目的是防止客户机被非法服务器诱骗。
相关检索结果3：
名称：识别虚假Wi-Fi的方法、客户端、服务器端和系统
专利申请号：CN201410447084.3
申请公布号：CN104219670A
该发明提供了一种识别虚假Wi-Fi的方法、客户端、服务器端和系统，属于无线网络安全领域。其中，所述的方法包括：客户端扫描Wi-Fi的服务集标识SSID，并获取所述服务集标识SSID对应的MAC地址；在MAC地址库中查询所述MAC地址是否存在，当查询结果表明所述MAC地址存在且位于MAC地址库的MAC黑库中时，将所述MAC地址对应的服务集标识SSID进行虚假标识。
技术要点比较：
该专利文献利用记载有伪造的虚假Wi-Fi的MAC黑库来识别伪基站，但是，该专利文献并没有给出如何将暂时还没有实施风险行为的诱骗伪基站归纳入黑库，因此这些诱骗伪基站将长期游离于黑库之外。而在本发明中，即使伪基站没有实施风险行为，一样可以在数据连接前识别出来。
相关检索结果4：
名称：一种无线AP的身份识别方法及终端
专利申请号：CN201410279425.0
申请公布号：CN104038939A
该发明实施例公开了一种无线AP的身份识别方法，包括：获取与终端连接的目标无线AP相关联的目标无线网络的SSID服务集标识和MAC物理地址；提示用户断开所述目标无线AP的电源，以使终端检测到不存在具有所述MAC和所述SSID的目标无线网络；若在第一预设时间内检测到不存在具有所述MAC和所述SSID的目标无线网络，提示用户接通所述目标无线AP的电源，以使所述终端能检测到具有所述MAC和所述SSID的目标无线网络；若在第二预设时间内检测到具有所述MAC和所述SSID的目标无线网络，识别出所述终端具有设置权限。
技术要点比较：
1、该发明对虚假Wi-Fi的识别是基于Wi-Fi标识SSID+MAC地址，而伪基站的Wi-Fi可以完全复制真Wi-Fi的SSID+MAC地址，因而无法做到完全保护手机通信的目的。
2、该发明对于无线AP的识别依赖于用户手动开关AP电源，即保证AP在相应时间段内，用户进行相应操作，从而保证安全连接。缺点有两个：(1)需要用户手动参与，对于公共Wi-Fi，用户无法手动关闭AP电源的情况下，该发明不适用。(2)在特定时间段内相应AP，如果此时有其他客户机在此时间段内响应AP，那么将无法识别伪AP。
相关检索结果5：
名称：用于监测伪无线接入点AP的方法及装置
专利申请号：CN201410638322.9
申请公布号：CN104349325A
该发明公开了一种用于监测伪无线接入点AP的方法及装置，其中方法包括：运营商部署的每一合法AP按如下方式监测伪AP：运营商管理的多个合法AP采用蜂窝型组网方案进行部署，每个合法AP工作在指定的信道上，且在进行数据传输的同时，扫描附近AP发出的信标帧；从获取的信标帧中提取扫描到的AP信息；将提取的AP信息与合法AP信息数据库进行比对，其中，合法AP信息数据库中存储合法AP的信息；当提取的AP信息不在合法AP信息数据库中，判定扫描到的AP为伪AP。
技术要点比较：
一方面，该专利文献需要借助于运营商提供的合法AP数据库作为匹配的依据， 属于基站验证，不属于客户机端的验证，即使一个合法AP识别出了伪AP，但是对于客户机来讲，其一无法得知发现该伪AP的信息，其二即使合法AP能够通知客户机发现了伪AP，可是客户机不能确定发出该通知的AP本身是否为合法AP还是伪AP；而本发明从客户机角度出发，并不依赖于运营商提供的合法AP数据库作为匹配的依据。
另一方面，该专利文献中的伪AP指的是不合法、未登记AP，而合法AP进行复位设置而带来的AP诱骗信息问题则并没有被考虑进去，所以本发明能够有效针对诱骗伪基站。又一方面，既然合法AP能够扫描附近AP发出的信标帧，则伪基站同样能够扫描到附近AP发出的信标帧，伪基站可以将自身的信标帧伪装成附近AP发出的信标帧并将信号发射功率大于合法AP，则仍可以实现诱骗；但是这样诱骗方式对本发明不起作用。
再一方面，该专利文献给出了与本发明完全相反的技术启示，具体地，该专利文献说明书第[0004]段记载到“目前针对伪AP的治理主要包括……在手机端增加伪AP监测功能……需要在用户手机上安装一个相应的应用软件，且用户每到一个新的无线局域网内，都要重新进行数据更新，难以实现伪AP的无缝监测”。
最后，该专利文献需要每个客户机中存有运营商的合法信息数据库，在客户机未连接上AP时，无法更新本地数据库，因此对于一些AP会有误判行为。
发明内容
针对现有技术中的缺陷，本发明的目的是提供一种基于客户机的主动防基站诱骗方法和系统。
根据本发明提供的一种基于客户机的主动防基站诱骗方法，包括如下试探步骤：
客户机向目标基站发送一组或多组认证信息，其中，至少有一组认证信息为伪装信息；
客户机根据目标基站对所述认证信息的反馈信息，对所述目标基站进行真伪识别，其中，反馈信息用于指示目标基站是否接受认证信息。
优选地，所述多组认证信息中包括至少一组真实信息，且客户机在每次识别过程中向目标基站发送的第一组认证信息为伪装信息。
优选地，客户机在各次识别过程中向目标基站所发送的认证信息的组数不完全相同。
优选地，客户机在各次识别过程中发送真实信息的序号(指发送顺序序号)不完全相同。
优选地，客户机仅在部分次数的识别过程中发送真实信息。
优选地，所述伪装信息是根据与客户机对应的历史基站信息和/或当前环境参数生成的。
优选地，在对所述目标基站进行真伪识别时：
若目标基站接受认证信息的正确率大于阈值，则认为目标基站的识别结果为真；反之，则认为目标基站的识别结果为伪。
优选地，所述试探步骤在客户机与目标基站建立数据通信之前或者数据通信中执行。
优选地，在一次识别过程中执行如下任意一个步骤：
-步骤I：客户机对目标基站针对前一组认证信息的反馈信息的正确性进行判断，若判断结果为正确的，则客户机继续向目标基站发送一组认证信息；其中，重复执行步骤I，直到目标基站针对为真实信息的认证信息的反馈信息是拒绝的、目标基站针对为伪装信息的认证信息的反馈信息是接受的、或者步骤I的重复执行次数达到设定值时，结束试探；或者
-步骤II：客户机根据目标基站对设定组数的多组认证信息的各个反馈信息对目标基站进行真伪识别后，结束试探。
根据本发明提供的一种基于客户机的主动防基站诱骗系统，包括用于试探目标基站的试探装置，所述试探装置包括如下装置：
第一发送装置：向目标基站发送一组或多组认证信息，其中，至少有一组认证信息为伪装信息；
第一识别装置：根据目标基站对所述认证信息的反馈信息，对所述目标基站进行真伪识别，其中，反馈信息用于指示目标基站是否接受认证信息。
优选地，所述多组认证信息中包括至少一组真实信息，且第一发送装置在每次识别过程中向目标基站发送的第一组认证信息为伪装信息。
优选地，第一发送装置在各次识别过程中向目标基站所发送的认证信息的组数不完全相同。
优选地，第一发送装置在各次识别过程中发送真实信息的序号不完全相同。
优选地，第一发送装置仅在部分次数的发送过程中发送真实信息。
优选地，所述伪装信息是根据与客户机对应的历史基站信息和/或当前环境参数生成的。
优选地，第一识别装置在对所述目标基站进行真伪识别时：
若目标基站接受认证信息的正确率大于阈值，则认为目标基站的识别结果为真；反之，则认为目标基站的识别结果为伪。
优选地，对目标基站的试探是在客户机与目标基站建立数据通信之前或者数据通信中执行。
优选地，第一识别装置包括如下任意一种装置：
-第二识别装置：在一次识别过程中，重复执行步骤I，直到目标基站针对为真实信息的认证信息的反馈信息是拒绝的、目标基站针对为伪装信息的认证信息的反馈信息是接受的、或者步骤I的重复执行次数达到设定值时，结束试探；其中，所述步骤I为：客户机对目标基站针对前一组认证信息的反馈信息的正确性进行判断，若判断结果为正确的，则客户机继续向目标基站发送一组认证信息；
-第三识别装置：在一次识别过程中，执行步骤II；其中，所述步骤II为：客户机根据目标基站对设定组数的多组认证信息的各个反馈信息对目标基站进行真伪识别后，结束试探。
与现有技术相比，本发明具有如下的有益效果：
1、本发明提供了基于客户机自防护的无线安全方案，客户机与基站进行一次或多次交互，主动识别出基站的真伪。
2、在伪基站诱骗客户机的情况下，在客户机与基站真正建立连接前，客户机主动发送认证信息，根据伪基站对客户机认证信息完全接受的特点，客户机主动识别伪基站，保证通信安全。
附图说明
通过阅读参照以下附图对非限制性实施例所作的详细描述，本发明的其它特征、目的和优点将会变得更明显：
图1为本发明提供的基于客户机的主动防基站诱骗系统的结构示意图；
图2为本发明提供的基于客户机的主动防基站诱骗方法的流程示意图；
图3为一组为真实信息的认证信息的示意图；
图4为图3中认证信息的伪装信息的示意图；
图5为客户机与基站之间多次交互识的原理示意图；
图6为本发明的应用原理图；
图7为本发明中试探装置的子装置之间的工作配合原理图，其中，“第一发送装置-第二识别装置”表示第一发送装置与第二识别装置之间的工作配合原理图，，“第一发送装置-第三识别装置”表示第一发送装置与第三识别装置之间的工作配合原理图。
具体实施方式
下面结合具体实施例对本发明进行详细说明。以下实施例将有助于本领域的技术人员进一步理解本发明，但不以任何形式限制本发明。应当指出的是，对本领域的普通技术人员来说，在不脱离本发明构思的前提下，还可以做出若干变化和改进。这些都属于本发明的保护范围。
根据本发明提供的一种基于客户机的主动防基站诱骗系统，包括用于试探目标基站的试探装置，所述试探装置包括如下装置：
第一发送装置：向目标基站发送一组或多组认证信息，其中，至少有一组认证信息为伪装信息；
第一识别装置：根据目标基站对所述认证信息的反馈信息，对所述目标基站进行真伪识别，其中，反馈信息用于指示目标基站是否接受认证信息。
优选地，所述多组认证信息中包括至少一组真实信息，且第一发送装置在每次识别过程中向目标基站发送的第一组认证信息为伪装信息。
优选地，第一发送装置在各次识别过程中向目标基站所发送的认证信息的组数不完全相同。
优选地，第一发送装置在各次识别过程中发送真实信息的序号不完全相同。
优选地，第一发送装置仅在部分次数的发送过程中发送真实信息。
优选地，所述伪装信息是根据与客户机对应的历史基站信息和/或当前环境参数生成的。
优选地，第一识别装置在对所述目标基站进行真伪识别时：
若目标基站接受认证信息的正确率大于阈值，则认为目标基站的识别结果为真；反之，则认为目标基站的识别结果为伪。
优选地，对目标基站的试探是在客户机与目标基站建立数据通信之前或者数据通信 中执行。
优选地，第一识别装置包括如下任意一种装置：
-第二识别装置：在一次识别过程中，重复执行步骤I，直到目标基站针对为真实信息的认证信息的反馈信息是拒绝的(即目标基站针对为真实信息的认证信息的反馈信息的正确性是错误的)、目标基站针对为伪装信息的认证信息的反馈信息是接受的(即目标基站针对为伪装信息的认证信息的反馈信息的正确性是错误的)、或者步骤I的重复执行次数达到设定值时，结束试探；其中，所述步骤I为：客户机对目标基站针对前一组认证信息的反馈信息的正确性进行判断，若判断结果为正确的，则客户机继续向目标基站发送一组认证信息；
-第三识别装置：在一次识别过程中，执行步骤II；其中，所述步骤II为：客户机根据目标基站对设定组数的多组认证信息的各个反馈信息对目标基站进行真伪识别后，结束试探。
所述基于客户机的主动防基站诱骗系统，可以通过一种基于客户机的主动防基站诱骗方法的流程步骤实现。本领域技术人员可以将所述基于客户机的主动防基站诱骗方法理解为所述基于客户机的主动防基站诱骗系统的一个实施例。所述基于客户机的主动防基站诱骗方法，具体如下。
根据本发明提供的一种基于客户机的主动防基站诱骗方法，包括如下试探步骤：
客户机向目标基站发送一组或多组认证信息，其中，至少有一组认证信息为伪装信息；
客户机根据目标基站对所述认证信息的反馈信息，对所述目标基站进行真伪识别，其中，反馈信息用于指示目标基站是否接受认证信息。也就是说，客户机根据反馈信息来验证目标基站对认证信息的处理是否符合预期，例如，客户机对所发送真实信息的预期为目标基站反馈通过认证，客户机对所发送伪装信息的预期为目标基站反馈未通过认证。
客户机可以采用无线方式(例如Wi-Fi等短距离无线通信方式)与目标基站(例如Wi-Fi基站)建立连接加入目标基站所在的无线局域网，然后通过目标基站连接入互联网。客户机可以是智能手机；客户机还可以是物联网终端，例如家用电器的物联盒。所述目标基站为无线基站。
所述试探步骤的目的在于，为了防止被伪基站诱骗得到密码等安全信息，通过基站对认证信息的反馈信息的正确性侦测是否存在伪基站的诱骗行为，让客户机不轻易被伪 基站诱骗成功导致主动将真实信息发出。进一步地，在防止客户机被伪基站诱骗的基础上，于优选例中，所述试探步骤的目的还在于，客户机通过试探步骤向作为目标基站的基站开展反向诱骗，使伪基站误以为已获得了为真实信息的认证信息，从而停止对真实信息的继续诱骗。
客户机对伪基站的反向诱骗的方式可以有多种。例如，反向诱骗伪基站将伪装信息误判为真实信息。又例如，反向诱骗伪基站将真实信息误判为伪装信息。还例如，反向诱骗伪基站误认为在客户机发出的多组认证信息中含有(或者不含有)真实信息。再例如，反向诱骗伪基站误认为客户机在每次真伪识别中发出的多组认证信息是有规律(或者无规律)的。更例如，反向诱骗伪基站误判客户机的试探已开始(或者未开始)以及试探已结束(或者未结束)。当然，以上的反向诱骗方式可以单一使用，也可以多种方式同时使用，尤其是在每次识别或试探中使用不完全相同的方式组合，以达到迷惑伪基站的效果。
每组认证信息可以由多个信息构成，其中在所述多个信息中至少有一个是私密信息(比如密码等)，即伪基站需要诱骗得到的信息。例如，每组认证信息可以主要由用户名和密码构成。
在客户机对目标基站发送的认证信息中，至少有一组认证信息为伪装信息，所述伪装信息是指用来针对目标基站伪装成真实信息的认证信息。若一基站对于伪装信息的反馈信息均是或者大部分都是接受认证(即认证通过)，则该基站可以认定为伪基站。
在更为复杂(或者说更为迷惑)的情况下，在客户机对目标基站发送的认证信息中还可以在伪装信息中混入真实信息。例如，若客户机在试探中发送的认证信息均是伪装信息，则伪基站可以设计为对所有认证信息的反馈信息均是拒绝(即不接受)以通过试探，因此，有必要在伪装信息中混入或者有可能混入真实信息，从而使得伪基站不知道是否要对某一个或某几个认证信息反馈接受以及不知道要对哪一个或对哪几个认证信息反馈拒绝，进而令伪基站不能够采取对所有认证信息的反馈信息均是拒绝的方式来通过试探。进一步地，客户机在此有可能混入真实信息的方式下，发送的认证信息可以均是伪装信息，从而令伪基站徒劳于在伪装信息中寻找其实并不存在的真实信息。
关于客户机在试探中发送的认证信息的组数，可以用来迷惑伪基站，使伪基站不知道试探何时开始以及结束。假设客户机始终发送固定组数的认证信息，则伪基站可以掌握到规律，得到固定组数下一组的为真实信息的认证信息。
所述“客户机向目标基站发送一组或多组认证信息”的步骤以及所述“客户机根据 目标基站对所述认证信息的反馈信息，对所述目标基站进行真伪识别”的步骤之间的执行顺序可以有多种方式。例如，首先，客户机向目标基站发送了多组认证信息，相应地，客户机也收到了目标基站的多个反馈信息，然后客户机对目标基站进行真伪识别。又例如，客户机向目标基站每发送一组认证信息后即根据该组认证信息的反馈信息进行即时(或实时)基站真伪识别，若识别结果为真基站，则继续发送下一组认证信息，若识别结果为伪基站，则可以结束试探。
所述客户机向目标基站发送一组或多组认证信息的步骤，可以由客户机主动启动执行以对周围的基站进行试探，并形成包含真基站的白名单与包含伪基站的黑名单，还可以由客户机在需要建立数据连接之前，对相应的基站进行试探，也可以在数据连接过程中对当前数据连接的基站进行试探。
所述对所述目标基站进行真伪识别的步骤，可以基于对应于一组认证信息的反馈信息或者对应于多组认证信息的反馈信息进行真伪识别，例如优选地将反馈信息正确率100％的基站才识别为真基站。其中，所述反馈信息用于指示目标基站是否接受认证信息。
在优选例中，客户机准备与一基站建立数据连接(该基站假设为伪基站)，因此对该基站进行试探以确保信息安全。为此，客户机向该基站发送了一组认证信息R1，该组认证信息R1为伪装信息，若该基站对该组认证信息R1的反馈信息为接受，即通过认证，则客户机将该基站识别为伪基站。
在优选例中，客户机准备与一基站建立数据连接(该基站假设为伪基站)，因此对该基站进行试探以确保信息安全。为此，客户机向该基站发送了两组认证信息R1、R2，该组认证信息R1、R2均为伪装信息，若该基站对该组认证信息R1的反馈信息为拒绝，即认证不通过，对认证信息组R2的反馈信息为接受，则客户机可以根据该基站的反馈信息的正确率为50％过低而将该基站识别为伪基站。
具体地，所述多组认证信息中包括至少一组真实信息，且客户机在每次识别过程中向目标基站发送的第一组认证信息为伪装信息。其中，向目标基站发送的第一组认证信息为伪装信息的目的是：若向目标基站发送的第一组认证信息为真实信息，则假设该基站为真基站，则该真基站的反馈信息为接受认证，假设该基站为伪基站，则该伪基站的反馈信息同样也是接受认证，则真基站的反馈信息与伪基站的反馈信息之间是体现不出区别的，因此，第一组认证信息为伪装信息。
在优选例中，客户机准备与一基站建立数据连接(该基站假设为伪基站)，因此对该基站进行试探以确保信息安全。为此，客户机向该基站先后发送了两组认证信息R1、 R2，认证信息组R1为伪装信息，认证信息组R2为真实信息。因此，若该伪基站对认证信息的接受以及拒绝策略为全部接受或者全部拒绝，则该伪基站对于认证信息组R1、R2的反馈信息的正确率不可能达到100％，而仅为50％。从而客户机能够识别出该基站为伪基站。
但是，在更为复杂的情况下，伪基站也许可以从多次试探的认证信息中得到真实信息。例如，在第一次试探中，客户机向伪基站发送了四组认证信息R101、R102、R103、R104，其中，R102为真实信息，其余为伪装信息；在第二次试探中，客户机向伪基站发送了三组认证信息R201、R202、R203，其中，R203为真实信息，其余为伪装信息；由于真实信息是不变的，即R102与R203是相同的，则伪基站可以通过从集合{R101、R102、R103、R104}与集合{R201、R202、R203}的交集中得到真实信息。为此，客户机可以在多次试探过程中，分别发送相同的一组或多组为伪装信息的认证信息，例如，令R101与R201相同，令R103与R202相同，这样，集合{R101、R102、R103、R104}与集合{R201、R202、R203}的交集中有两组认证信息是由伪装信息构成的，仅一组认证信息是由真实信息构成的，当每次试探中发送的认证信息组数较多时，则该交集的元素也会很多，从而给伪基站从中找出真实信息带来困难。
具体地，客户机仅在部分次数的识别过程中发送真实信息，其中，所述试探与所述识别是一一对应的，即，客户机执行一次试探，则对应进行一次识别。在上述复杂情况下，客户机还可以在多次试探过程中，分别发送相同的一组或多组为伪装信息的认证信息，并且在至少一次试探中不发送由真实信息构成为认证信息。例如，在第一次试探中，客户机向伪基站发送了四组认证信息R101、R102、R103、R104，其中，R102为真实信息，其余为伪装信息；在第二次试探中，客户机向伪基站发送了三组均为伪装信息的认证信息R201、R202、R203，且R103与R203相同，R101与R202相同，则在集合{R101、R102、R103、R104}与集合{R201、R202、R203}的交集{R103、R201}中不存在真实信息，达到反向诱骗伪基站，使伪基站误认为在该交集中存在真实信息的错误判断。
具体地，客户机在各次识别过程中向目标基站所发送的认证信息的组数不完全相同。伪基站可以通过掌握每次识别(即试探)过程中客户机向目标基站发送的认证信息组数，当试探结果为真基站时，客户机再次发送认证信息时，应该向该真基站发送为真实信息的认证信息，从而通过真基站的认证。若伪基站能够确认客户机的试探已结束，则可以获得并认定客户机下一次发送的认证信息是由真实信息构成的。因此，对客户机而言，不能让伪基站掌握到何时试探开始以及何时试探结束。因此，客户机在各次识别 过程中向目标基站所发送的认证信息的组数不完全相同，从而使得伪基站不能从认证信息发送的组数上知道何时试探开始以及何时试探结束。
更为具体地，在部分或全部次数的试探中，客户机发送相邻组认证信息的时间间隔可以全部相同、部分相同、或者全部不相同，从而使得伪基站也不能从认证信息的发送时间上找到何时试探开始以及何时试探结束。例如，客户机以时间间隔t1依次发送了八组认证信息，并以时间间隔t2(t2>t1)发送由伪装信息构成的第九组认证信息，以反向诱骗伪基站误认为在客户机发送第八组认证信息后试探已结束，进而得到第九组认证信息是由真实信息构成的误判。又例如，
客户机在第一次试探中以时间间隔t1依次发送了八组认证信息，并在第八组认证信息发送时间的时间间隔t1后在第二次试探中以时间间隔t1发送了两组认证信息，并以时间间隔t2发送了第三组认证信息，以反向诱骗伪基站误认为在客户机发送第八组认证信息后试探还没有结束，并误认为该次试探一共发送了十组试探信息，并认为第二次试探中的第三组认证信息为新的一次试探的开始，而恰恰可以将该第二次试探中的第三组认证信息设定为由真实信息构成。
具体地，客户机在各次识别过程中发送真实信息的序号(指发送顺序序号)不完全相同。例如，假设客户机在两次试探中均发送十组认证信息，则可以在第一次试探时通过第二组认证信息发送真实信息，在第二次试探时通过第五组认证信息发送真实信息。
具体地，所述伪装信息是根据与客户机对应的历史基站信息和/或当前环境参数生成的。伪基站确认为真实信息的认证信息的途径之一，是首先识别出那些为伪装信息的认证信息，则余下的认证信息可判断为是真实信息。因此，客户机有必要防止伪基站掌握为伪装信息的认证信息的生成方法。
例如，客户机可以根据历史基站信息中的基站的SSID(Service Set Identifier)、与SSID对应的客户机密码、上次客户机连接地点，以及客户机所处于的其他客观因素(例如客户机的开机时间、当前温度等当前环境参数)，利用位移、加密等数学算法，生成一个记载有多组认证信息的认证信息表单。该认证信息表单储存N组认证信息，每组认证信息有个真伪字段属性：为真实信息的认证信息的真伪字段属性为真，为伪装信息的认证信息的真伪字段属性为伪。N为大于1的正整数。
具体地，所述试探步骤在客户机与目标基站建立数据通信之前执行。在建立数据通信之前，客户机需试探基站是否为真基站，若为伪基站，则不能建立数据通信，即，在客户机与基站连接前，通过主动与基站进行交互，达到安全连接。
具体地，所述试探步骤在客户机与目标基站数据通信中执行。当客户机与真基站建立数据通信后，若伪基站的信号发射功率大于真基站，则伪基站会对真基站造成干扰与屏蔽，使得客户机被强制连接到伪基站，因此，即使客户机在当前时刻是与真基站建立的数据连接，但是，在数据通信连接中不能排除下一个时刻被强制连接至伪基站，因此对于客户机而言下一个时刻是否继续数据连接需要对当前通信数据连接的基站进行真伪识别，也就是说，下一时刻的基站对于客户机来讲是一个待识别真伪后才确认是否保持数据连接或者重新数据连接的待识别连接对象。因此，可以在在客户机与目标基站数据通信中执行所述试探步骤，以识别当前与客户机连接的基站是否为真基站，并在当前与客户机连接的基站为伪基站时中断数据通信连接。也就是说，在客户机与基站通信过程中，可以间歇性的执行试探步骤以保护客户机，确保实时的安全连接。
具体地，在对所述目标基站进行真伪识别时，在一次识别过程中执行步骤I或者步骤II。
-步骤I：客户机对目标基站针对前一组认证信息的反馈信息的正确性进行判断，若判断结果为正确的，则客户机继续向目标基站发送一组认证信息；其中，重复执行步骤I，直到目标基站针对为真实信息的认证信息的反馈信息是拒绝的、目标基站针对为伪装信息的认证信息的反馈信息是接受的、或者步骤I的重复执行次数达到设定值时，结束试探。客户机对基站的真伪进行实时识别。
例如，在一次试探中，客户机已发出了三组均为伪装信息的认证信息R1、R2、R3，基站对该三组认证信息的反馈信息均为拒绝，即基站对于该三组认证信息的反馈信息均正确，随后，客户机发出第四组为伪装信息的认证信息R4，基站对该第四组认证信息R4的反馈信息为接受，即该基站对于该第四组认证信息的反馈信息是错误的，因此客户机将该基站识别为伪基站后结束试探。
又例如，若目标基站的历次反馈信息保持正确，则客户机继续向目标基站发送一组认证信息进行真伪识别，直到客户机向目标基站发送的真实信息的反馈信息是正确的时将基站识别为真基站后结束试探。比如，在一次试探中，客户机已发出了四组均为伪装信息的认证信息R1、R2、R3、R4，基站对该四组认证信息的反馈信息均为拒绝，即基站对于该四组认证信息的反馈信息均正确，随后，客户机发出第五组为真实信息的认证信息R5，基站对该第五组认证信息R5的反馈信息为接受，即该基站对于该第五组认证信息的反馈信息是正确的，因此客户机将该基站识别为真基站后结束试探。
再例如，在一次试探中，客户机已发出了四组均为伪装信息的认证信息R1、R2、R3、 R4，基站对该四组认证信息的反馈信息均为拒绝，即基站对于该四组认证信息的反馈信息均正确，随后，客户机检测到在本次试探中，发出的认证信息的组数已达到阈值n，则客户机不再发出第五组认证信息，而是将该基站识别为真基站后结束试探。
-步骤II：客户机根据目标基站对设定组数的多组认证信息的各个反馈信息对目标基站进行真伪识别后，结束试探。具体地，重复执行步骤n次：客户机向基站发送一组认证信息，然后接收基站对该组认证信息的反馈信息；得到n个反馈信息。然后客户机根据该n个反馈信息对基站的真伪进行识别。若目标基站接受认证信息的正确率大于阈值，则认为目标基站的识别结果为真；反之，则认为目标基站的识别结果为伪。其中，阈值优选的为100％。
其中，n为正整数，其数值可以预先设定，例如为了防止试探识别的时间过长，则可以将n的数值设置为20。优选地，在每次识别过程中n的取值为一个数值范围中的值，例如，将n的取值数值范围设定为10到20，则每次识别过程中n的取值为10到20中的随机数，其中，本领域技术人员可以参照现有技术实现随机数的生成算法，在此不再赘述。
下面对一个优选的具体实施方式进行描述。
在作为客户机的智能移动设备系统(Android/IOS/WP/Linux/塞班等系统)中嵌入本发明提供的基于客户机的主动防基站诱骗系统，或者在集成电路芯片中(如51单片机/ARM单片机/AVR单片机/嵌入式模块中)，嵌入本发明提供的基于客户机的主动防基站诱骗系统，采用如下步骤：
-客户机判断附近是否存在可连接且历史上数据连接过的热点基站；若存在，则进入下述步骤继续执行；若不存在，则可对可用热点基站进行手动触发连接；
-通过执行步骤“客户机向目标基站发送一组或多组认证信息”以及步骤“客户机根据目标基站对所述认证信息的反馈信息，对所述目标基站进行真伪识别”的试探步骤，得到基站的真伪识别结果；若识别结果为真，则与该真基站进行数据连接，若识别结果为伪，则由用户判断是否需要手动触发连接；
-在数据连接中，通过执行所述试探步骤对当前连接的基站进行真伪识别；若识别结果为真，则与该真基站保持数据连接，若识别结果为伪，则由用户判断是否需要继续。
本发明还提供一种存储有计算机程序的计算机可读存储介质，其中，所述计算机可读存储介质中的计算机程序使计算机执行所述基于客户机的主动防基站诱骗方法，所述计算机可读存储介质包括光盘、磁盘、ROM、PROM、VCD、DVD等；所述基于客户机的主 动防基站诱骗方法，包括如下试探步骤：
客户机向目标基站发送一组或多组认证信息，其中，至少有一组认证信息为伪装信息；
客户机根据目标基站对所述认证信息的反馈信息，对所述目标基站进行真伪识别，其中，反馈信息用于指示目标基站是否接受认证信息。
优选地，所述多组认证信息中包括至少一组真实信息，且客户机在每次识别过程中向目标基站发送的第一组认证信息为伪装信息。
优选地，客户机在各次识别过程中向目标基站所发送的认证信息的组数不完全相同。
优选地，客户机在各次识别过程中发送真实信息的序号不完全相同。
优选地，客户机仅在部分次数的识别过程中发送真实信息。
优选地，所述伪装信息是根据与客户机对应的历史基站信息和/或当前环境参数生成的。
优选地，在对所述目标基站进行真伪识别时：
若目标基站接受认证信息的正确率大于阈值，则认为目标基站的识别结果为真；反之，则认为目标基站的识别结果为伪。
优选地，所述试探步骤在客户机与目标基站建立数据通信之前或者数据通信中执行。
优选地，在一次识别过程中执行如下任意一个步骤：
-步骤I：客户机对目标基站针对前一组认证信息的反馈信息的正确性进行判断，若判断结果为正确的，则客户机继续向目标基站发送一组认证信息；其中，重复执行步骤I，直到目标基站针对为真实信息的认证信息的反馈信息是拒绝的、目标基站针对为伪装信息的认证信息的反馈信息是接受的、或者步骤I的重复执行次数达到设定值时，结束试探；或者
-步骤II：客户机根据目标基站对设定组数的多组认证信息的各个反馈信息对目标基站进行真伪识别后，结束试探。
本领域技术人员知道，除了以纯计算机可读程序代码方式实现本发明提供的系统及其各个装置以外，完全可以通过将方法步骤进行逻辑编程来使得本发明提供的系统及其各个装置以逻辑门、开关、专用集成电路、可编程逻辑控制器以及嵌入式微控制器等的形式来实现相同功能。所以，本发明提供的系统及其各项装置可以被认为是一种硬件部 件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构；也可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件部件内的结构。
以上对本发明的具体实施例进行了描述。需要理解的是，本发明并不局限于上述特定实施方式，本领域技术人员可以在权利要求的范围内做出各种变化或修改，这并不影响本发明的实质内容。在不冲突的情况下，本申请的实施例和实施例中的特征可以任意相互组合。

Claims (18)

  1. 一种基于客户机的主动防基站诱骗方法，其特征在于，包括如下试探步骤：
    客户机向目标基站发送一组或多组认证信息，其中，至少有一组认证信息为伪装信息；
    客户机根据目标基站对所述认证信息的反馈信息，对所述目标基站进行真伪识别，其中，反馈信息用于指示目标基站是否接受认证信息。
  2. 根据权利要求1所述的基于客户机的主动防基站诱骗方法，其特征在于，所述多组认证信息中包括至少一组真实信息，且客户机在每次识别过程中向目标基站发送的第一组认证信息为伪装信息。
  3. 根据权利要求1所述的基于客户机的主动防基站诱骗方法，其特征在于，客户机在各次识别过程中向目标基站所发送的认证信息的组数不完全相同。
  4. 根据权利要求2所述的基于客户机的主动防基站诱骗方法，其特征在于，客户机在各次识别过程中发送真实信息的序号不完全相同。
  5. 根据权利要求1所述的基于客户机的主动防基站诱骗方法，其特征在于，客户机仅在部分次数的识别过程中发送真实信息。
  6. 根据权利要求1所述的基于客户机的主动防基站诱骗方法，其特征在于，所述伪装信息是根据与客户机对应的历史基站信息和/或当前环境参数生成的。
  7. 根据权利要求1所述的基于客户机的主动防基站诱骗方法，其特征在于，在对所述目标基站进行真伪识别时：
    若目标基站接受认证信息的正确率大于阈值，则认为目标基站的识别结果为真；反之，则认为目标基站的识别结果为伪。
  8. 根据权利要求1所述的基于客户机的主动防基站诱骗方法，其特征在于，所述试探步骤在客户机与目标基站建立数据通信之前或者数据通信中执行。
  9. 根据权利要求1所述的基于客户机的主动防基站诱骗方法，其特征在于，在一次识别过程中执行如下任意一个步骤：
    -步骤I：客户机对目标基站针对前一组认证信息的反馈信息的正确性进行判断，若判断结果为正确的，则客户机继续向目标基站发送一组认证信息；其中，重复执行步骤I，直到目标基站针对为真实信息的认证信息的反馈信息是拒绝的、目标基站针对为伪装信息的认证信息的反馈信息是接受的、或者步骤I的重复执行次数达到设定值时， 结束试探；或者
    -步骤II：客户机根据目标基站对设定组数的多组认证信息的各个反馈信息对目标基站进行真伪识别后，结束试探。
  10. 一种基于客户机的主动防基站诱骗系统，其特征在于，包括用于试探目标基站的试探装置，所述试探装置包括如下装置：
    第一发送装置：向目标基站发送一组或多组认证信息，其中，至少有一组认证信息为伪装信息；
    第一识别装置：根据目标基站对所述认证信息的反馈信息，对所述目标基站进行真伪识别，其中，反馈信息用于指示目标基站是否接受认证信息。
  11. 根据权利要求10所述的基于客户机的主动防基站诱骗系统，其特征在于，所述多组认证信息中包括至少一组真实信息，且第一发送装置在每次识别过程中向目标基站发送的第一组认证信息为伪装信息。
  12. 根据权利要求10所述的基于客户机的主动防基站诱骗系统，其特征在于，第一发送装置在各次识别过程中向目标基站所发送的认证信息的组数不完全相同。
  13. 根据权利要求11所述的基于客户机的主动防基站诱骗系统，其特征在于，第一发送装置在各次识别过程中发送真实信息的序号不完全相同。
  14. 根据权利要求10所述的基于客户机的主动防基站诱骗系统，其特征在于，第一发送装置仅在部分次数的发送过程中发送真实信息。
  15. 根据权利要求10所述的基于客户机的主动防基站诱骗系统，其特征在于，所述伪装信息是根据与客户机对应的历史基站信息和/或当前环境参数生成的。
  16. 根据权利要求10所述的基于客户机的主动防基站诱骗系统，其特征在于，第一识别装置在对所述目标基站进行真伪识别时：
    若目标基站接受认证信息的正确率大于阈值，则认为目标基站的识别结果为真；反之，则认为目标基站的识别结果为伪。
  17. 根据权利要求10所述的基于客户机的主动防基站诱骗系统，其特征在于，对目标基站的试探是在客户机与目标基站建立数据通信之前或者数据通信中执行。
  18. 根据权利要求10所述的基于客户机的主动防基站诱骗系统，其特征在于，第一识别装置包括如下任意一种装置：
    -第二识别装置：在一次识别过程中，重复执行步骤I，直到目标基站针对为真实信息的认证信息的反馈信息是拒绝的、目标基站针对为伪装信息的认证信息的反馈信息 是接受的、或者步骤I的重复执行次数达到设定值时，结束试探；其中，所述步骤I为：客户机对目标基站针对前一组认证信息的反馈信息的正确性进行判断，若判断结果为正确的，则客户机继续向目标基站发送一组认证信息；
    -第三识别装置：在一次识别过程中，执行步骤II；其中，所述步骤II为：客户机根据目标基站对设定组数的多组认证信息的各个反馈信息对目标基站进行真伪识别后，结束试探。
PCT/CN2016/101527 2015-08-26 2016-10-09 基于客户机的主动防基站诱骗方法和系统 WO2017032347A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510531828.4A CN105208562A (zh) 2015-08-26 2015-08-26 基于客户机的主动防基站诱骗方法和系统
CN201510531828.4 2015-08-26

Publications (1)

Publication Number Publication Date
WO2017032347A1 true WO2017032347A1 (zh) 2017-03-02

Family

ID=54955921

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/101527 WO2017032347A1 (zh) 2015-08-26 2016-10-09 基于客户机的主动防基站诱骗方法和系统

Country Status (2)

Country Link
CN (1) CN105208562A (zh)
WO (1) WO2017032347A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105208562A (zh) * 2015-08-26 2015-12-30 盾宇（上海）信息科技有限公司 基于客户机的主动防基站诱骗方法和系统
CN107222860A (zh) * 2016-03-22 2017-09-29 中兴通讯股份有限公司 一种识别伪基站的方法和装置
CN107241732A (zh) * 2016-03-29 2017-10-10 努比亚技术有限公司 移动终端开机注册网络的控制方法及装置
CN107241722A (zh) * 2016-03-29 2017-10-10 努比亚技术有限公司 网络通信处理方法及装置
CN108738023A (zh) * 2017-04-24 2018-11-02 中国移动通信有限公司研究院 防止物联网终端接入伪基站的方法、物联网服务器和系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130152167A1 (en) * 2011-12-13 2013-06-13 Samsung Electronics Co., Ltd Apparatus and method for identifying wireless network provider in wireless communication system
CN103874068A (zh) * 2014-03-20 2014-06-18 工业和信息化部电信研究院 一种识别伪基站的方法和装置
CN104284337A (zh) * 2014-10-11 2015-01-14 河南天安润信信息技术有限公司 一种基站检测方法及系统
CN105208562A (zh) * 2015-08-26 2015-12-30 盾宇（上海）信息科技有限公司 基于客户机的主动防基站诱骗方法和系统
CN105681272A (zh) * 2015-12-08 2016-06-15 哈尔滨工业大学（威海） 一种移动终端钓鱼WiFi的检测与抵御方法

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103067922A (zh) * 2013-01-24 2013-04-24 中兴通讯股份有限公司 无线局域网防范非法接入点的方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130152167A1 (en) * 2011-12-13 2013-06-13 Samsung Electronics Co., Ltd Apparatus and method for identifying wireless network provider in wireless communication system
CN103874068A (zh) * 2014-03-20 2014-06-18 工业和信息化部电信研究院 一种识别伪基站的方法和装置
CN104284337A (zh) * 2014-10-11 2015-01-14 河南天安润信信息技术有限公司 一种基站检测方法及系统
CN105208562A (zh) * 2015-08-26 2015-12-30 盾宇（上海）信息科技有限公司 基于客户机的主动防基站诱骗方法和系统
CN105681272A (zh) * 2015-12-08 2016-06-15 哈尔滨工业大学（威海） 一种移动终端钓鱼WiFi的检测与抵御方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
XIA, GUOQING ET AL.: "Research on Wireless Rogue AP Recognition Method Based on Device Fingerprinting", COMPUTER TECHNOLOGY AND DEVELOPMENT, vol. 25, no. 1, 31 January 2015 (2015-01-31) *

Also Published As

Publication number Publication date
CN105208562A (zh) 2015-12-30

Similar Documents

Publication Publication Date Title
WO2017032347A1 (zh) 基于客户机的主动防基站诱骗方法和系统
US10412083B2 (en) Dynamically generated SSID
CN109462850A (zh) 一种智能设备的网络配置方法及智能设备
CN107770226B (zh) 一种智能家居的控制方法、装置、家庭网关及移动终端
US20060161770A1 (en) Network apparatus and program
JP6690326B2 (ja) 無線通信プログラム、方法及び装置
US10412078B2 (en) Advanced local-network threat response
CN103313429A (zh) 一种识别伪造wifi热点的处理方法
WO2016188053A1 (zh) 一种无线网络接入方法、装置及计算机存储介质
Sung et al. Protecting end-device from replay attack on LoRaWAN
US20190075465A1 (en) Systems and Methods for Providing Wireless Access Security by Interrogation
CN111130769A (zh) 一种物联网终端加密方法及装置
WO2017032346A1 (zh) 基于无线安全的客户机自连接保护方法和系统
CN106878992B (zh) 无线网络安全检测方法和系统
CN113259134B (zh) 基于人脸识别的服务器防护方法、装置、设备及介质
CN108235322B (zh) 一种无线设备的反制方法及装置
CN111405548B (zh) 一种钓鱼wifi的检测方法及装置
CN106714158B (zh) 一种WiFi接入方法及装置
US20210067961A1 (en) Secure simultaneous authentication of equals anti-clogging mechanism
CN105873034A (zh) 一种安全的热点信息处理方法
CN105873035A (zh) 一种安全的ap信息处理方法
CN106162644A (zh) 一种可防止伪装设备的WiFi系统及其安全验证方法
CN107948140B (zh) 便携式设备的校验方法和系统
CN106101058A (zh) 一种基于二维码的热点信息处理方法
CN106028327A (zh) 一种通过认证服务器实现热点安全的方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16838605

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16838605

Country of ref document: EP

Kind code of ref document: A1